A federated learning model poisoning defense method, a terminal and a storage medium

Abstract

The application discloses a federal learning model poisoning defense method, a terminal and a storage medium, and the method comprises the following steps: selecting a matched clipping threshold according to the norm of each local model increment and the corresponding data set, and adaptively clipping the corresponding local model increment according to the selected clipping threshold; determining the sign feature of the current global model increment according to the clipped local model increment, and calculating the selection coefficient corresponding to the clipped local model according to the determined sign feature of the current global model increment; and selectively aggregating each clipped local model according to the calculated selection coefficient to obtain a global model; the application can effectively defend against model poisoning attack means such as label flipping scaling attack, sign flipping attack and minimization maximum distance attack, and can help the center server to complete the aggregation of the local model without collecting the original data of the client and without increasing the local calculation amount of the client, thereby enhancing the reliability and robustness of the federal learning framework.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and particularly relates to a federated learning model poisoning defense method, a terminal and a storage medium. BACKGROUND

[0002] Artificial intelligence technology undoubtedly has great potential and value, and is expected to bring great changes to various industries and even the development of human society. However, the services and data provided by various enterprises or institutions are mostly independent of each other, and the amount of data owned by each enterprise or institution may not be sufficient to train a practical artificial intelligence model. Effective data is often scattered among various enterprises or institutions in the form of "data islands", and the data is difficult to interconnect, and the value is difficult to further tap. At the same time, the concerns of all sectors of society about data privacy and security have brought greater challenges to the full use of data.

[0003] Federated learning provides a feasible solution for this purpose. Its architecture is usually composed of a central server and several clients, each client has absolute autonomy over local data, and the central server has no access or scheduling of these data. When the clients jointly train a global model, the clients only interact with the server for parameters. However, due to the particularity and complexity of the traditional federated learning framework, malicious attackers can make the model training go in the wrong direction through model poisoning attacks. In particular, under the default architecture of federated learning, the central server is difficult to detect and monitor the clients. These characteristics give attackers greater power, and the presence of malicious attackers is more difficult to detect, and model poisoning attacks are easier to achieve.

[0004] As a privacy computing framework, federated learning is expected to become the basis of the next generation of artificial intelligence collaboration network architecture. In practical applications, the security of the federated learning framework itself is also particularly important. However, the current defense methods against model poisoning attacks are all proposed for traditional centralized machine learning or distributed learning, and will have problems such as inapplicability, limited effect, etc. in the environment of federated learning. For example, in the framework of distributed learning, some mechanisms can be designed to detect and filter malicious models, thereby resisting potential attackers. However, the data in the federated learning environment is usually not independent and identically distributed, which can easily cause these mechanisms to misjudge or miss the situation. In recent years, the most common method is to design a Byzantine robust aggregator to estimate a global model with Byzantine elasticity according to all local models collected. However, the clients upload gradients in distributed learning, while the clients upload models in federated learning, which gives malicious models a relatively larger hiding space.

[0005] Therefore, the prior art still needs to be improved. SUMMARY

[0006] The technical problem solved by the present application is that, in view of the defects of the prior art, the present application provides a federated learning model poisoning defense method, a terminal and a storage medium to solve the technical problem that the conventional defense method is difficult to detect malicious models.

[0007] The technical solution adopted by the present application to solve the technical problem is as follows:

[0008] In a first aspect, the present application provides a federated learning model poisoning defense method, comprising:

[0009] According to the norm of each local model increment and the corresponding data set, a matching clipping threshold is selected, and the corresponding local model increment is adaptively clipped according to the selected clipping threshold;

[0010] According to the clipped local model increment, the sign feature of the current global model increment is determined, and the selection coefficient corresponding to the clipped local model is calculated according to the determined sign feature of the current global model increment;

[0011] According to the calculated selection coefficient, the clipped local models are selectively aggregated to obtain a global model.

[0012] In an implementation manner, the clipping threshold is adaptively generated according to the training model increment, and the corresponding local model increment is adaptively clipped according to the clipping threshold.

[0013] According to the trained local models and the corresponding data sets, the training model increment of each local model is obtained;

[0014] According to the obtained training model increment, a clipping threshold is adaptively generated, and the corresponding local model increment is adaptively clipped according to the clipping threshold.

[0015] In an implementation manner, the clipping threshold is adaptively generated according to the training model increment, and the corresponding local model increment is adaptively clipped according to the clipping threshold.

[0016] The two-norm of the obtained training model increment is taken as a median, and a clipping threshold is adaptively generated according to the taken median;

[0017] The training model increment of each local model is norm-clipped according to a preset algorithm to limit the contribution degree of each local model to the global model.

[0018] In an implementation manner, the clipping threshold is adaptively generated according to the training model increment, and the corresponding local model increment is adaptively clipped according to the clipping threshold.

[0019] According to the pruned local model increment, a current model increment of a corresponding client is determined;

[0020] According to the current model increment, sign information of a dimension parameter value is extracted;

[0021] According to the extracted sign information and a sign feature of an expected global increment, a selection coefficient corresponding to the pruned local model is calculated.

[0022] In an implementation manner, the extracting of the sign information of the dimension parameter value according to the current model increment comprises:

[0023] A sign function is defined;

[0024] The current model increment is input into the sign function as an input parameter;

[0025] The sign information of the dimension parameter value is extracted according to the sign function.

[0026] In an implementation manner, the calculating of the selection coefficient corresponding to the pruned local model according to the extracted sign information and the sign feature of the expected global increment comprises:

[0027] The sign feature of the expected global increment is defined;

[0028] According to the sign feature of the global increment and the extracted sign information, a sign consistency parameter ratio of the current model increment and the global increment is calculated, to obtain the selection coefficient corresponding to the pruned local model.

[0029] In an implementation manner, the selective aggregation of the pruned local models according to the calculated selection coefficient to obtain the global model comprises:

[0030] The selection coefficient is used as an aggregation probability of each pruned local model;

[0031] The pruned local models are selectively aggregated according to the aggregation probability and an aggregation algorithm.

[0032] In an implementation manner, the selective aggregation of the pruned local models according to the aggregation probability and the aggregation algorithm comprises:

[0033] It is judged according to the aggregation probability whether a corresponding pruned local model increment meets an aggregation condition;

[0034] If yes, the pruned local model increment meeting the condition is selected;

[0035] The selected pruned local model increment and the aggregation algorithm are used for selective aggregation, to obtain the global model.

[0036] In a second aspect, the present application also provides a terminal, comprising a processor and a memory, wherein the memory stores a federated learning model poisoning defense program, and the federated learning model poisoning defense program is used to implement the operations of the federated learning model poisoning defense method according to the first aspect when executed by the processor.

[0037] In a third aspect, the present application also provides a storage medium, which is a computer readable storage medium, and the storage medium stores a federated learning model poisoning defense program, and the federated learning model poisoning defense program is used to implement the operations of the federated learning model poisoning defense method according to the first aspect when executed by a processor.

[0038] The technical scheme of the present application has the following effects:

[0039] The present application uses the model poisoning defense strategy of destroying malicious model features, avoids the limitations of norm and cosine similarity detection, and has good resistance to various model poisoning attack methods such as label flipping scaling attack, symbol flipping attack, and minimization maximum distance attack, thereby providing another effective idea for resisting model poisoning attacks. In addition, the adaptive norm clipping method is used to clip the local model of each client, which can dynamically limit the influence of malicious models on the global model of the center server. The present application uses the sign of the local model update increment as the basis to real-time investigate the consistency between the local model update increment and the global update increment expected by the center server, thereby selectively aggregating the model parameters, and further enhancing the security of the federated learning framework. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from the structures shown in the drawings without creative labor.

[0041] Figure 1 is a flowchart of the federated learning model poisoning defense method in an implementation manner of the present application.

[0042] Figure 2 is a basic framework diagram of the federated learning model poisoning defense based on selective aggregation in an implementation manner of the present application.

[0043] Figure 3 is an algorithm schematic diagram of the federated learning model poisoning defense based on selective aggregation in an implementation manner of the present application.

[0044] Figure 4 is a functional schematic diagram of a terminal in an implementation manner of the present application.

[0045] The implementation, functional features and advantages of the present application will be further described with reference to the embodiments and in conjunction with the drawings. DETAILED DESCRIPTION

[0046] To make the objectives, technical solutions and advantages of the present application clearer and more explicit, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0047] Exemplary method

[0048] The federated learning technology can jointly use the data of multiple participants to establish a machine learning model while avoiding the collection of raw data. This mechanism naturally solves the problems of data collection and processing of sensitive data, can protect the privacy of users, and is expected to bridge data silos. However, malicious attackers can affect the performance of the global model by tampering with the learning results of the local model, leading to incorrect decision-making of the model or endangering data privacy. Such model poisoning attacks pose a significant threat to the current federated learning architecture, and therefore, it is of great significance to defend against model poisoning attacks in federated learning and thereby enhance the robustness of federated learning.

[0049] To solve the above technical problems, the embodiments of the present application provide a federated learning model poisoning defense method, which uses a perturbation mechanism mainly to eliminate malicious features, so that the center server in the federated learning architecture can destroy the structure of malicious models during the aggregation of local models of each client, reducing the negative impact of malicious models on the global model. The center server can reliably and robustly complete the training of the global model while protecting the training data.

[0050] The embodiments of the present application are different from the previous conventional defense methods, and can effectively defend against various model poisoning attack methods for federated learning, such as label flipping scaling attack, symbol flipping attack, and minimax distance attack. It is a general aggregation method for federated learning based on client-server architecture, which can help the center server to complete the aggregation of local models without collecting raw data of clients and without increasing the amount of local computation of clients, aiming to enhance the reliability and robustness of the federated learning framework.

[0051] As shown in Figure 1 The embodiments of the present application provide a federated learning model poisoning defense method, which includes the following steps:

[0052] Step S100: Select a matching pruning threshold based on the norm of each local model increment and the corresponding dataset, and perform adaptive pruning on the corresponding local model increment based on the selected pruning threshold.

[0053] In this embodiment, the federated learning model poisoning defense method is applied to a terminal, which includes, but is not limited to, devices such as computers and mobile terminals.

[0054] In this embodiment, the technical problem to be solved is as follows: First, taking the attack method of minimizing the maximum distance as an example, we will illustrate the difficulty of current defense methods in resisting model poisoning attacks, and the technical difficulties that this invention aims to solve. Most currently used defense methods are based on detecting the L2 norm and cosine similarity of model parameters. Malicious models W may bypass this traditional defense method. f The following two conditions are often met:

[0055] 1. Latency on the L2 norm. Malicious locality model W f Compared with the normal global model The Euclidean distance between them is greater than that of other correct local models W i arrive The maximum distance is smaller, meaning there exists a correct local model W. i It arrived The Euclidean distance is greater than W f arrive The Euclidean distance is larger. The formal description is shown in equation (1):

[0056]

[0057] 2. Latency in cosine similarity. If W f With W i The included angle between them is W i and The angle between them is smaller, that is, W exists. i It and The cosine angle is equal to W f and If the cosine angle is larger, then the local model is considered to be hidden in terms of cosine similarity, as formally described by formula (2):

[0058]

[0059] As can be seen from the implementation of the minimization maximum distance attack, a malicious attacker can calculate an estimate of a global model based on existing information. Approaching Based on this, attackers can scale the parameters of a malicious model to make W... fThe design of the malicious model satisfies formula (1) and formula (2) at the same time, which shows that the malicious model can evade detection of the model norm and can evade detection of the model cosine similarity. Since the attacker has stronger ability under the model poisoning threat model and the attack method is various, it is very difficult to detect the malicious model by using the traditional defense method.

[0060] Since the malicious attacker can construct the malicious model targetedly to evade the conventional detection means skillfully, the embodiment of the present application does not detect and resist the malicious model by means of the norm or the cosine similarity like the traditional defense method. The core idea of the embodiment of the present application is to consider selecting only a part of parameters of each client for aggregation, and to destroy the characteristics of the malicious model by reducing the integrity of the local model. In general distributed learning, if the server only uses the sign of the gradient vector of each client to update the global model, the global model will eventually also converge. According to this research result, the direction of model update plays a more important role in updating the model. Adaptive model clipping can effectively suppress the effect of the malicious model at the level of the two-norm, but will not change the sign of the model increment ΔW, so the embodiment of the present application takes the sign of the model increment as the parameter selection standard to complete the selective aggregation of the model parameters.

[0061] Specifically, in an implementation manner of the embodiment, the step S100 includes the following steps:

[0062] Step S101, obtaining each local model after training;

[0063] Step S102, obtaining the training model increment of each local model according to each local model after training and the corresponding data set;

[0064] Step S103, adaptively generating a clipping threshold according to the obtained training model increment, and adaptively clipping the corresponding local model increment according to the clipping threshold.

[0065] In the embodiment, the basic framework of the federated learning model poisoning defense based on selective aggregation is as shown in Figure 2 The method mainly includes the following three processes:

[0066] 1. Local model adaptive clipping;

[0067] 2. Calculation of selection coefficient β;

[0068] 3. Selective aggregation of local model parameters.

[0069] In the process of local model self-adaptive clipping, in the embodiment, considering that the attacker can enhance the attack effect by scaling the local model parameters, the center server needs to clip the norm of the local model to limit the contribution of the local model to the global model. Since federated learning is to concentrate calculation at the local client, the global model is quickly adjusted by AW, which reduces the communication overhead and accelerates the model convergence. Therefore, excessive clipping of the model will affect the convergence of the model and reduce the final model accuracy.

[0070] Specifically, in an implementation manner of the embodiment, step S103 includes the following steps:

[0071] Step S103a, taking the median of the two-norm of the obtained training model increment, and adaptively generating a clipping threshold according to the taken median;

[0072] Step S103b, performing norm clipping on the training model increment of each local model according to a preset algorithm to limit the contribution degree of each local model to the global model.

[0073] In the embodiment, for different models and data sets, the average two-norm change of the model increment AW i of the client i in the training process is different; for the same model and data set, if the client data distribution is different, the two-norm change is also different. Therefore, it is very important to select a suitable clipping threshold C, the smaller the threshold, the better the model limitation, but the model convergence may be slower; the larger the threshold, the faster the model convergence, but there is a risk of being unable to suppress malicious information. In the context of poisoning attack and defense, the value of the threshold C should be adaptive. Since the number of attackers in the threat model is usually a minority, the embodiment of the application adopts the scheme of formula (3), that is, taking the median of the two-norm of AW i , to adaptively generate a clipping threshold.

[0074] C=med(||AW i ||∣i∈[k])#(3)

[0075] Subsequently, the center server clips the update increment of each local model according to formula (4) to limit their contribution to the global model.

[0076]

[0077] The application utilizes the model poisoning defense strategy of destroying malicious model features, avoids the limitations of norm and cosine similarity detection, and specifically designs a new defense method based on selective aggregation; the adaptive norm clipping method is used to clip the local model of each client, which can dynamically limit the influence of malicious models on the global model of the center server.

[0078] As Figure 1 shown in the implementation of the embodiment of the present application, the federated learning model poisoning defense method further comprises the following steps:

[0079] Step S200, determining the sign feature of the current global model increment according to the pruned local model increment, and calculating the selection coefficient corresponding to the pruned local model according to the determined sign feature of the current global model increment.

[0080] In this embodiment, the introduction of an adaptive model pruning process before selective aggregation can significantly reduce the enhancement effect of the attacker's attack through parameter scaling means. Again, based on the sign of the model increment, the selection ratio is determined from the local models submitted by each client through the Hamming distance, and the local models are selectively aggregated. In the last model aggregation stage, the integrity of the malicious model parameters is efficiently destroyed, thereby achieving the purpose of defending against model poisoning attacks.

[0081] Specifically, in an implementation of the embodiment, step S200 comprises the following steps:

[0082] Step S201, determining the current model increment of the corresponding client according to the pruned local model increment;

[0083] Step S202, extracting the sign information of the parameter values of each dimension according to the current model increment;

[0084] Step S203, calculating the selection coefficient corresponding to the pruned local model according to the extracted sign information and the sign feature of the expected global increment.

[0085] In this embodiment, in the calculation process of the selection coefficient β, the current model increment of the pruned local model in the client is used to extract the sign feature of each local model, i.e. the sign information of the parameter values of each dimension. According to the sign information and the sign feature of the expected global increment, the selection coefficient corresponding to each local model is determined, thereby determining the contribution of each local model to the global model.

[0086] Specifically, in an implementation of the embodiment, step S202 comprises the following steps:

[0087] Step S202a, defining a sign function;

[0088] Step S202b, inputting the current model increment as an input parameter into the sign function;

[0089] Step S202c, extracting the sign information of the parameter values of each dimension according to the sign function.

[0090] In this embodiment, after local model self-adaptive pruning, the model increment of each client is obtained The sign function sign(·) is defined, which takes the model increment as the parameter, extracts the sign information of the parameter value of each dimension, and returns +1 if the parameter is greater than 0, otherwise returns -1. The final return result is denoted as ΔW i sign = sign(ΔW i c ), which has the same structure as the input parameter. The global model increment sign mask W mask is defined, which represents the sign characteristics of the global increment expected under normal circumstances, and is calculated by formula (5).

[0091]

[0092] Finally, the selection coefficient β i of each local model is obtained by formula (6). i The β i reflects the proportion of parameters with the same sign as ΔW mask and W mask , and the smaller the value is, the more consistent the sign of ΔWi is with the estimated value. The calculation process of the dimension XOR can be regarded as calculating the Hamming distance between ΔW i and W mask .

[0093]

[0094] Specifically, in an implementation manner of the embodiment, step S203 includes the following steps:

[0095] Step S203a, defining the sign characteristics of the expected global increment;

[0096] Step S203b, according to the sign characteristics of the global increment and the extracted sign information, calculating the sign consistency parameter proportion of the current model increment and the global increment, and obtaining the selection coefficient corresponding to the pruned local model.

[0097] The defense method based on selective aggregation in the embodiment has more stable defense effect, and has good resistance to various model poisoning attack methods such as label flipping scaling attack, sign flipping attack, and minimization maximum distance attack, thereby providing another effective idea for resisting model poisoning attack. Moreover, the sign of the local model update increment is taken as the basis to real-time investigate the consistency between the local model update increment and the global update increment expected by the center server, so as to selectively aggregate the model parameters, thereby further enhancing the security of the federated learning framework.

[0098] As Figure 1As shown, in an implementation form of the embodiment of the present application, the federated learning model poisoning defense method further includes the following steps:

[0099] In step S300, the selected local models after pruning are selectively aggregated according to the calculated selection coefficients to obtain a global model.

[0100] In this embodiment, the security problem of the federated learning framework is studied by focusing on the defense method against model poisoning attacks in federated learning, so as to improve the reliability and robustness of the federated learning framework. The model poisoning attack is a specific threat model in the federated learning scenario. A reasonable and effective defense method needs to consider the concealment, flexibility and complexity of the model poisoning attack, and design a targeted defense mechanism. The malicious model designed by the malicious client through the poisoning means often carries specific malicious features. The selective aggregation mechanism can destroy such malicious features, thereby achieving the defense effect of the model poisoning attack.

[0101] Specifically, in an implementation form of the embodiment, step S300 includes the following steps:

[0102] In step S301, the selection coefficient is used as the aggregation probability of each local model after pruning.

[0103] In step S302, the local models after pruning are selectively aggregated according to the aggregation probability and the aggregation algorithm.

[0104] In this embodiment, in the process of selective aggregation of local model parameters, the selection coefficient β of each local model is calculated i After that, it is used as a probability to determine whether the parameters of each dimension of the local model participate in the final aggregation, as shown in formula (7).

[0105]

[0106] Wherein, r is a random number generated each time, which obeys a uniform distribution between 0 and 1. The symbol * represents a placeholder, indicating that the parameter at the current position does not participate in the final model aggregation calculation.

[0107] Specifically, in an implementation form of the embodiment, step S302 includes the following steps:

[0108] In step S302a, it is judged whether the corresponding local model increment after pruning satisfies the aggregation condition according to the aggregation probability.

[0109] In step S302b, if yes, the local model increment after pruning that satisfies the condition is selected.

[0110] Step S302c, according to the selected cropped local model increment and the aggregation algorithm, selective aggregation is performed to obtain the global model.

[0111] In this embodiment, the selected model parameters are aggregated as a global model As shown in formula (8).

[0112]

[0113] Based on the above three processes, the algorithm of the federated learning model poisoning defense method based on selective aggregation designed by the present application is as shown in formula (8). Figure 3

[0114] As shown in the following table, the present embodiment verifies the defense effect of different federated learning aggregation mechanisms on common model poisoning attacks on the FASHION-MNIST public data set.

[0115]

[0116]

[0117] Among them, No Defense means not setting any defense, Krum, Median, TrimmedMean respectively represent three commonly used defense methods, Selective represents the federated learning model poisoning defense method based on selective aggregation proposed by the present application. No attack means not setting model poisoning attack, sign-flipping means sign-flipping attack, Min-Max means minimum maximum distance attack, and label-flipping+scaling means label-flipping+scaling attack.

[0118] From the above table, for the sign-flipping attack, because the attack directly reverses the model update as a whole, it will seriously reduce the accuracy of the model, and Selective using the model sign as a feature shows the best defense effect; for the minimum maximum distance attack, the model accuracy after using the Krum defense method is lower than that without using the defense method, which shows that this attack successfully bypasses the defense method and thus avoids detection, and Selective achieves the best defense; for the label-flipping+scaling attack, Krum achieves an exceptionally superior defense, but it will cause a very serious loss of model accuracy, and Selective still has a certain defense effect. Based on the above analysis results, the defense effect of Selective is more balanced and has a certain resistance to most attack methods. In addition, the method designed by the present application can improve the accuracy of the global model without model poisoning attack.

[0119] ​The embodiment achieves the following technical effects through the above technical scheme.

[0120] The embodiment utilizes the model poisoning defense strategy with the idea of destroying malicious model features, avoids the limitations of norm and cosine similarity detection, and has good resistance to various model poisoning attack methods such as label flipping scaling attack, symbol flipping attack, and minimum maximum distance attack, thereby providing another effective idea for resisting model poisoning attacks. In addition, the adaptive norm clipping method is used to cut the local model of each client, which can dynamically limit the influence of the malicious model on the global model of the center server. The embodiment takes the symbol of the local model update increment as the basis, and real-time investigates the consistency between the local model update increment and the global update increment expected by the center server, thereby selectively aggregating the model parameters, and further enhancing the security of the federated learning framework.

[0121] Exemplary device

[0122] Based on the above embodiment, the application further provides a terminal, comprising: a processor, a memory, an interface, a display screen and a communication module connected through a system bus; wherein the processor is used to provide computing and control capabilities; the memory includes a storage medium and an internal memory; the storage medium stores an operating system and a computer program; the internal memory provides an environment for the operation of the operating system and the computer program in the storage medium; the interface is used to connect external devices, such as mobile terminals and computer devices; the display screen is used to display corresponding information; and the communication module is used to communicate with a cloud server or a mobile terminal.

[0123] The computer program is executed by the processor to implement the operations of the federated learning model poisoning defense method.

[0124] Those skilled in the art can understand that, Figure 4 The principle block diagram shown in the figure is only a block diagram of part of the structure related to the application scheme, and does not constitute a limitation on the terminal to which the application scheme is applied. The specific terminal can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0125] In one embodiment, a terminal is provided, comprising: a processor and a memory, wherein the memory stores a federated learning model poisoning defense program, and the federated learning model poisoning defense program is executed by the processor to implement the operations of the federated learning model poisoning defense method as described above.

[0126] In an embodiment, a storage medium is provided, wherein the storage medium stores a federated learning model poisoning defense program, the federated learning model poisoning defense program, when executed by the processor, is configured to implement the operations of the federated learning model poisoning defense method as described above.

[0127] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware, and the computer program can be stored in a non-volatile storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. Any reference to memory, storage, database or other medium used in the embodiments of the present application can include non-volatile and / or volatile memory.

[0128] In summary, the present application provides a federated learning model poisoning defense method, a terminal and a storage medium. The method comprises: selecting a matched clipping threshold according to the norm of each local model increment and the corresponding data set, and adaptively clipping the corresponding local model increment according to the selected clipping threshold; determining the sign feature of the current global model increment according to the clipped local model increment, and calculating the selection coefficient corresponding to the clipped local model according to the determined sign feature of the current global model increment; selectively aggregating each clipped local model according to the calculated selection coefficient to obtain a global model. The present application can effectively defend against various model poisoning attack methods against federated learning, such as label flipping scaling attack, sign flipping attack, minimax distance attack, etc. It can help the center server to complete the aggregation of local models without collecting client original data and without increasing the local computation of the client, thereby enhancing the reliability and robustness of the federated learning framework.

[0129] It should be understood that the application of the present application is not limited to the above examples, and those skilled in the art can make improvements or changes according to the above description, and all these improvements and changes shall belong to the protection scope of the appended claims of the present application.

Claims

1. A federated learning model poisoning defense method, characterized in that, The method comprises the following steps: According to the norm of each local model increment and the corresponding data set, a matching clipping threshold is selected, and the corresponding local model increment is adaptively clipped according to the selected clipping threshold; According to the clipped local model increment, the sign feature of the current global model increment is determined, and the selection coefficient corresponding to the clipped local model is calculated according to the determined sign feature of the current global model increment; According to the calculated selection coefficient, the clipped local models are selectively aggregated to obtain a global model; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; 2. The federated learning model poisoning defense method of claim 1, wherein, According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the model increment, the selection proportion is determined from the local model submitted by each client through the Hamming distance, the parameter aggregation of the local model is selectively performed, the integrity of the malicious model parameter is destroyed in the model aggregation stage, and the defense purpose of the model poisoning attack is achieved.

3. The federated learning model poisoning defense method of claim 2, wherein, According to the norm of each local model increment and the corresponding data set, a matching clipping threshold is selected, and the corresponding local model increment is adaptively clipped according to the selected clipping threshold; According to the clipped local model increment, the sign feature of the current global model increment is determined, and the selection coefficient corresponding to the clipped local model is calculated according to the determined sign feature of the current global model increment; According to the calculated selection coefficient, the clipped local models are selectively aggregated to obtain a global model; 4. The federated learning model poisoning defense method of claim 1, wherein, According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model increment, the sign feature of the current model increment of the corresponding client is determined; According to the current model increment, the sign information of the parameter value of each dimension is extracted; According to the extracted sign information and the sign feature of the expected global increment, the selection coefficient corresponding to the clipped local model is calculated; According to the clipped local model According to the aggregation probability and the respective pruned local model, selective aggregation is performed according to the aggregation algorithm.

5. The federated learning model poisoning defense method of claim 4, wherein, The selective aggregation according to the aggregation probability and the respective pruned local model includes: According to the aggregation probability, it is determined whether the corresponding pruned local model increment satisfies an aggregation condition; If yes, the pruned local model increment satisfying the condition is selected; According to the selected pruned local model increment and the aggregation algorithm, selective aggregation is performed to obtain the global model.

6. A terminal, characterized by comprising: It includes: A processor and a memory, the memory stores a federated learning model poisoning defense program, and the federated learning model poisoning defense program is used to implement the operations of the federated learning model poisoning defense method in any one of claims 1-5 when executed by the processor.

7. A storage medium, characterized by The storage medium is a computer readable storage medium, and the storage medium stores a federated learning model poisoning defense program, and the federated learning model poisoning defense program is used to implement the operations of the federated learning model poisoning defense method in any one of claims 1-5 when executed by the processor.

Images